T1653 — Power Settings

Tactic: Persistence · Platforms: Windows, Linux, macOS, Network Devices

Adversaries may impair a system's ability to hibernate, reboot, or shut down in order to extend access to infected machines. When a computer enters a dormant state, some or all software and hardware may cease to operate which can disrupt malicious activity. Adversaries may abuse system utilities…

Sigma detection rules (3)

T1653 Power Settings

title: T1653 Power Settings
id: 6b9910cd-422d-432b-8e88-94156a1f0bbe
description: 'Detects powercfg.exe usage to disable hibernation/sleep or extend power-plan idle/monitor timeouts, a technique adversaries use to keep an infected host from locking, sleeping, or shutting down so malicious activity is not interrupted. Tune using: AllowedAdminTools, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1653
author: Shahrukh Khan
date: 2026-04-02
license: MIT
tags:
  - attack.persistence
  - attack.t1653

logsource:
  category: process_creation
  product: windows
  service: sysmon

detection:
  selection_powercfg:
    Image|endswith: '\powercfg.exe'
  selection_action:
    CommandLine|contains:
      - 'hibernate-off'
      - '/hibernate off'
      - '-hibernate off'
      - 'standby-timeout-ac 0'
      - 'monitor-timeout-ac 0'
      - '/setactive'

  condition: selection_powercfg and selection_action

falsepositives:
  - Legitimate IT/power-management scripts adjusting power plans on kiosks, always-on servers, or during help-desk troubleshooting.

level: low

T1653 Power Settings

title: T1653 Power Settings
id: b91ddabd-a567-4304-a1d3-27dce513c6f9
description: 'Detection Strategy for Power Settings Abuse. (Retargeted to the file_change auditd telemetry that actually captures this techniques behavior; see logsource below.) Tune using: KnownMaintenanceWindows.'
references:
  - https://attack.mitre.org/techniques/T1653
author: Shahrukh Khan
date: 2026-01-11
license: MIT
tags:
  - attack.persistence
  - attack.t1653

logsource:
  category: file_change
  product: linux

detection:
  selection_path:
    name|endswith:
      - '/etc/systemd/sleep.conf'
      - '/etc/systemd/logind.conf'
      - '/etc/systemd/sleep.conf.d/'
  selection_type:
    type: 'PATH'
    nametype: 'NORMAL'
  filter_maintenance:
    exe|endswith:
      - '/apt'
      - '/dpkg'
      - '/yum'
      - '/dnf'

  condition: selection_path and selection_type and not filter_maintenance

falsepositives:
  - Legitimate power-management tuning by system administrators or configuration-management tools (Ansible, Puppet) during declared maintenance windows.

level: medium

T1653 Power Settings

title: T1653 Power Settings
id: e0b17fd9-9a35-490c-b561-d681c98fbb52
description: 'Detection Strategy for Power Settings Abuse. (Retargeted to the file_change macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: AdminWhitelists.'
references:
  - https://attack.mitre.org/techniques/T1653
author: Shahrukh Khan
date: 2026-02-05
license: MIT
tags:
  - attack.persistence
  - attack.t1653

logsource:
  category: file_change
  product: macos

detection:
  selection:
    TargetFilename|endswith: '/com.apple.PowerManagement.plist'

  condition: selection

falsepositives:
  - Users adjusting sleep or display settings through System Settings routinely trigger the same power management plist update.

level: low

Explore